Unauthorized modification of displ.content in CRM_WR_SYSTEM, SAP security note 1490229

SAP security note 1490229, "Unauthorized modification of displ.content in CRM_WR_SYSTEM". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify displayed application content without proper authorization. This could lead to unauthorized modifications and the potential theft of authentication information from other users.

Solution

Apply the SAP Security Note 1490229 using the SAP Note Assistant.

Reason and prerequisites

Pages within the CRM_WR_SYSTEM component do not sufficiently encode output parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. An attacker can exploit this vulnerability to non-permanently deface or modify displayed content on the website.

Reflected XSS can be used to steal another user’s authentication information, such as data related to their current session. An attacker who gains access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, it could lead to a full compromise of the application’s security.

References

• SAP Note 1468574 – CRM-BF: SAP CRM 2005 – SP Stack 17
• SAP Note 1468573 – CRM-BF: SAP CRM 5.2 – SP Stack 10

Affected components

• BBPCRM 400
• BBPCRM 500
• BBPCRM 510
• BBPCRM 520
• BBPCRM 600
• BBPCRM 700
• BBPCRM 701